ADB (Android Debug Bridge)

ADB (Android Debug Bridge) is the command-line tool from the Android SDK Platform-Tools that talks to a device over USB, or over Wi-Fi with wireless debugging (Android 11 and later, with pairing). It has three parts: the adb client on the workstation, a server on the workstation (TCP port 5037) and the adbd daemon on the phone. Commands run on the device as the unprivileged shell user (UID 2000), not as root.

For investigators ADB is the backbone of logical acquisition:

adb devices -l                                  # device must show "device", not "unauthorized"
adb shell getprop ro.build.fingerprint          # exact build
adb shell dumpsys package com.whatsapp          # install times, installer, permissions
adb pull /sdcard/DCIM ./DCIM                    # shared storage
adb bugreport case0142_bugreport.zip            # system service dumps and logs
adb backup -f backup.ab -apk -shared -all       # legacy backup, limited on Android 12+

ADB requires Developer options and USB debugging to be enabled, which in turn requires the phone to be unlocked, and the user must accept the workstation's RSA key. Accepted keys are stored on the device in /data/misc/adb/adb_keys, itself an artifact: it shows which computers were authorised. Android 11 and later expire authorisations unused for seven days by default. Enabling debugging and accepting a key are changes to the device: record them. See Android acquisition methods.